3
ãdeg ã               @   s   d dl Z d dlZd dlZd dlZd dlZd dlmZ d dlmZmZ d dl	m
Z
mZ d dlmZ d dlmZ d dlmZ d dlmZmZmZmZ d d	lmZmZmZ d d
lmZmZ d dlmZm Z m!Z! d dl"m#Z#m$Z$ d dl%m&Z& d dl'm(Z( d dl)m*Z*m+Z+ d dl,m-Z-m.Z. d dl/m0Z0m1Z1 d dl2m3Z4 d dl5m6Z6 d dl7m8Z8m9Z9 d dl:m;Z; d dl<m=Z=m>Z>m?Z?m@Z@mAZAmBZBmCZCmDZD d dlEmFZFmGZGmHZHmIZI d dlJmKZKmLZL d dlMmNZNmOZO d dlPmQZQmRZRmSZSmTZTmUZUmVZVmWZWmXZXmYZYmZZZm[Z[m\Z\ d dl]m^Z^m_Z_m`Z`maZambZbmcZcmdZdmeZemfZf d dlgmhZh d dlimjZj d dlkmlZlmmZmmnZnmoZompZp e jqdd d!gƒZrG d"d#„ d#ƒZsG d$d%„ d%ƒZtG d&d'„ d'ƒZueteQd(œd)d*„Zvetƒ ZwdS )+é    N)Úcontextmanager)ÚutilsÚx509)ÚUnsupportedAlgorithmÚ_Reasons)Úaead)Ú_CipherContext)Ú_CMACContext)Ú_dh_params_dupÚ_DHParametersÚ_DHPrivateKeyÚ_DHPublicKey)Ú_DSAParametersÚ_DSAPrivateKeyÚ_DSAPublicKey)Ú_EllipticCurvePrivateKeyÚ_EllipticCurvePublicKey)Ú_ED448_KEY_SIZEÚ_Ed448PrivateKeyÚ_Ed448PublicKey)Ú_Ed25519PrivateKeyÚ_Ed25519PublicKey)Ú_HashContext)Ú_HMACContext)Ú_POLY1305_KEY_SIZEÚ_Poly1305Context)Ú_RSAPrivateKeyÚ_RSAPublicKey)Ú_X448PrivateKeyÚ_X448PublicKey)Úopenssl)Úbinding)ÚhashesÚserialization)ÚAsymmetricPadding)ÚdhÚdsaÚecÚed448Úed25519ÚrsaÚx448Úx25519)ÚMGF1ÚOAEPÚPSSÚPKCS1v15)ÚPrivateKeyTypesÚPublicKeyTypes)ÚBlockCipherAlgorithmÚCipherAlgorithm)ÚAESÚAES128ÚAES256ÚARC4ÚSM4ÚCamelliaÚChaCha20Ú	TripleDESÚ_BlowfishInternalÚ_CAST5InternalÚ_IDEAInternalÚ_SEEDInternal)	ÚCBCÚCFBÚCFB8ÚCTRÚECBÚGCMÚOFBÚXTSÚMode)Úscrypt)Ússh)ÚPBESÚPKCS12CertificateÚPKCS12KeyAndCertificatesÚPKCS12PrivateKeyTypesÚ_PKCS12CATypesÚ
_MemoryBIOÚbioZchar_ptrc               @   s   e Zd ZdS )Ú_RC2N)Ú__name__Ú
__module__Ú__qualname__© rW   rW   úc/var/www/agendate/envp3/lib/python3.6/site-packages/cryptography/hazmat/backends/openssl/backend.pyrS   {   s   rS   c               @   sž	  e Zd ZdZdZddddddhZefZej	ej
ejejejejejejejejejejfZejejejejfZd	Zd
Zdd	> Zd	Zde> Z ddœdd„Z!e"dœdd„Z#�d+e$e%j&e%j'e(j)  ddœdd„Z*e$dœdd„Z+ddœdd„Z,ddœdd„Z-e.j/dd„ ƒZ0ddœdd„Z1e"dœdd „Z2e"dœd!d"„Z3e4dœd#d$„Z5e6ej7e8d%œd&d'„Z9ej7d(œd)d*„Z:ej7d(œd+d,„Z;ej7e$d-œd.d/„Z<ej7e$d-œd0d1„Z=e$dœd2d3„Z>ej7e$d-œd4d5„Z?ej7ej@d-œd6d7„ZAeBeCe$d8œd9d:„ZDddœd;d<„ZEddœd=d>„ZFeBeCeGd8œd?d@„ZHeBeCeGd8œdAdB„ZIej7e$d-œdCdD„ZJej7e4e6e4e6e6dEœdFdG„ZKe%j'e(j) dœdHdI„ZLe4dœdJdK„ZM�d,e4dLœdMdN„ZNe4e4eOjPdOœdPdQ„ZQe4e4e$dOœdRdS„ZReOjSe$eOjPdTœdUdV„ZTeOjUeOjVdWœdXdY„ZWdZd[„ ZXd\d]„ ZYe6eZd^œd_d`„Z[dadb„ Z\e6dœdcdd„Z]e$e^deœdfdg„Z_e`dœdhdi„Zaej7e$d-œdjdk„Zbece$dlœdmdn„Zdece$dlœdodp„Zee4efjgdqœdrds„Zhefjgefjidtœdudv„Zje4efjidqœdwdx„Zkddœdydz„ZlefjmefjidWœd{d|„ZnefjoefjpdWœd}d~„ZqefjrefjgdWœdd€„Zsd�d‚„ Zte$dœdƒd„„Zuej7e$d-œd…d†„Zve$dœd‡dˆ„Zwexeyd-œd‰dŠ„Zze6e%j&e6 e$e^d‹œdŒd�„Z{e6e`d^œdŽd�„Z|e6e}j~d^œd�d‘„Ze6e%j&e6 e$e^d‹œd’d“„Z€d”d•„ Z�e6e`d^œd–d—„Z‚e6e}j~d^œd˜d™„Zƒe„j…e%j†dšœd›dœ„Z‡e%j†e„j…d�œdždŸ„Zˆddœd d¡„Z‰e^dœd¢d£„ZŠe%j‹dœd¤d¥„ZŒej�e$d¦œd§d¨„ZŽej�ej�e$d©œdªd«„Z�ej�ej‘d¦œd¬d­„Z’ej“ej‘dWœd®d¯„Z”ej•ej–dWœd°d±„Z—ej�e6ej–d²œd³d´„Z˜e4ej�ej‘dµœd¶d·„Z™ej�d¸œd¹dº„Zše4d»œd¼d½„Z›ejœej�e$d¾œd¿dÀ„Z�dÁdÂ„ Zžej�e4d¦œdÃdÄ„ZŸe/dÅdÆ„ ƒZ e4e4ddÇœdÈdÉ„Z¡e¢j£e¢j¤e¢j¥e6dÊœdËdÌ„Z¦e6dœdÍdÎ„Z§e6dœdÏdÐ„Z¨e¢j£e¢j©e6dÑœdÒdÓ„Zªe$dœdÔdÕ„Z«e4e4e}j~dÖœd×dØ„Z¬dÙdÚ„ Z­e}j~e}j®dtœdÛdÜ„Z¯e4e4e}j®dÖœdÝdÞ„Z°e}j±e}j®dWœdßdà„Z²e}j³e}j´dWœdádâ„Zµe}j¶e}j~dWœdãdä„Z·�d-e4e4e%j&e4 e$dåœdædç„Z¸e$dœdèdé„Z¹e6eºj»d^œdêdë„Z¼e6eºj½d^œdìdí„Z¾dîdï„ Z¿eºj½dœdðdñ„ZÀe$dœdòdó„ZÁe6eÂjÃd^œdôdõ„ZÄe6eÂjÅd^œdöd÷„ZÆeÂjÅdœdødù„ZÇe$dœdúdû„ZÈe$dœdüdý„ZÉe6eÊjËd^œdþdÿ„ZÌe6eÊjÍd^œ�d �d„ZÎeÊjÍdœ�d�d„ZÏe$dœ�d�d„ZÐe6eÑjÒd^œ�d�d„ZÓe6eÑjÔd^œ�d�d	„ZÕeÑjÔdœ�d
�d„ZÖe6e6e4e4e4e4e6�dœ�d�d„Z×e$dœ�d�d„ZØe4d�dœ�d�d„ZÙe.j/�d�d„ ƒZÚe6e%j&e6 e%jÛe%j&e^ e%j&e„j… e%j'e„j… f �dœ�d�d„ZÜe6e%j&e6 eÝ�dœ�d�d„ZÞe%j&e6 e%j&eß e%j&e„j… e%j&e%j'eà  e¢j¥e6�dœ�d�d„Záe$dœ�d�d„Zâe6eã�d œ�d!�d"„Zäe$dœ�d#�d$„Zåe6e%j'e„j… d^œ�d%�d&„Zæe6e%j'e„j… d^œ�d'�d(„Zçe%j'e„j… dœ�d)�d*„ZèdS (.  ÚBackendz)
    OpenSSL API binding interfaces.
    r    s   aes-128-ccms   aes-192-ccms   aes-256-ccms   aes-128-gcms   aes-192-gcms   aes-256-gcmi   i  é   N)Úreturnc             C   s‚   t jƒ | _| jj| _| jj| _| jƒ | _i | _	| j
ƒ  | jrR| jjrRtjdtƒ n| jƒ  | jjg| _| jjr~| jj| jjƒ d S )Nz<OpenSSL FIPS mode is enabled. Can't enable DRBG fork safety.)r!   ZBindingÚ_bindingÚffiÚ_ffiÚlibÚ_libÚ_is_fips_enabledÚ_fips_enabledÚ_cipher_registryÚ_register_default_ciphersÚ"CRYPTOGRAPHY_NEEDS_OSRANDOM_ENGINEÚwarningsÚwarnÚUserWarningÚactivate_osrandom_engineZEVP_PKEY_DHÚ	_dh_typesÚCryptography_HAS_EVP_PKEY_DHXÚappendZEVP_PKEY_DHX)ÚselfrW   rW   rX   Ú__init__±   s    



zBackend.__init__c             C   s   dj | jƒ | j| jjƒS )Nz3<OpenSSLBackend(version: {}, FIPS: {}, Legacy: {})>)ÚformatÚopenssl_version_textrb   r\   Ú_legacy_provider_loaded)rm   rW   rW   rX   Ú__repr__Ç   s    zBackend.__repr__)ÚokÚerrorsr[   c             C   s   t j| j||d�S )N)rt   )r!   Z_openssl_assertr`   )rm   rs   rt   rW   rW   rX   Úopenssl_assertÎ   s    zBackend.openssl_assertc             C   s>   | j jr| j j| jjƒ}n
| j jƒ }|dkr6| j jƒ  t|ƒS )Nr   )r`   ZCryptography_HAS_300_FIPSZ&EVP_default_properties_is_fips_enabledr^   ÚNULLZ	FIPS_modeZERR_clear_errorÚbool)rm   ÚmoderW   rW   rX   ra   Õ   s    

zBackend._is_fips_enabledc             C   s$   | j jƒ  | jƒ st‚| jƒ | _d S )N)r\   Ú_enable_fipsra   ÚAssertionErrorrb   )rm   rW   rW   rX   ry   â   s    
zBackend._enable_fipsc             C   sf   | j jrb| j jƒ }|| jjkrb| j j|ƒ | j j| jjƒ}| j|dkƒ | j j|ƒ}| j|dkƒ d S )NrZ   )	r`   re   ZENGINE_get_default_RANDr^   rv   ZENGINE_unregister_RANDÚRAND_set_rand_methodru   ÚENGINE_finish)rm   ÚeÚresrW   rW   rX   Úactivate_builtin_randomé   s    
zBackend.activate_builtin_randomc             c   s‚   | j j| j jƒ}| j|| jjkƒ | j j|ƒ}| j|dkƒ z
|V  W d | j j|ƒ}| j|dkƒ | j j|ƒ}| j|dkƒ X d S )NrZ   )	r`   ZENGINE_by_idZCryptography_osrandom_engine_idru   r^   rv   ZENGINE_initZENGINE_freer|   )rm   r}   r~   rW   rW   rX   Ú_get_osurandom_engineö   s    
zBackend._get_osurandom_enginec          
   C   s`   | j jr\| jƒ  | jƒ � }| j j|ƒ}| j|dkƒ W d Q R X | j j| jjƒ}| j|dkƒ d S )NrZ   )	r`   re   r   r€   ZENGINE_set_default_RANDru   r{   r^   rv   )rm   r}   r~   rW   rW   rX   ri   
  s    
z Backend.activate_osrandom_enginec             C   s`   | j jddƒ}| jƒ �2}| jj|dt|ƒ|| j jdƒ}| j|dkƒ W d Q R X | j j|ƒj	dƒS )Nzchar[]é@   s   get_implementationr   Úascii)
r^   Únewr€   r`   ZENGINE_ctrl_cmdÚlenrv   ru   ÚstringÚdecode)rm   Úbufr}   r~   rW   rW   rX   Úosrandom_engine_implementation  s    
z&Backend.osrandom_engine_implementationc             C   s   | j j| jj| jjƒƒjdƒS )zÀ
        Friendly string name of the loaded OpenSSL library. This is not
        necessarily the same version as it was compiled against.

        Example: OpenSSL 1.1.1d  10 Sep 2019
        r‚   )r^   r…   r`   ZOpenSSL_versionÚOPENSSL_VERSIONr†   )rm   rW   rW   rX   rp     s    zBackend.openssl_version_textc             C   s
   | j jƒ S )N)r`   ZOpenSSL_version_num)rm   rW   rW   rX   Úopenssl_version_number*  s    zBackend.openssl_version_number)ÚkeyÚ	algorithmr[   c             C   s   t | ||ƒS )N)r   )rm   r‹   rŒ   rW   rW   rX   Úcreate_hmac_ctx-  s    zBackend.create_hmac_ctx)rŒ   c             C   sL   |j dks|j dkr0dj|j |jd ƒjdƒ}n|j jdƒ}| jj|ƒ}|S )NÚblake2bÚblake2sz{}{}é   r‚   )Únamero   Údigest_sizeÚencoder`   ZEVP_get_digestbyname)rm   rŒ   ÚalgÚevp_mdrW   rW   rX   Ú_evp_md_from_algorithm2  s    zBackend._evp_md_from_algorithmc             C   s    | j |ƒ}| j|| jjkƒ |S )N)r–   ru   r^   rv   )rm   rŒ   r•   rW   rW   rX   Ú_evp_md_non_null_from_algorithm=  s    
z'Backend._evp_md_non_null_from_algorithm)rŒ   r[   c             C   s.   | j rt|| jƒ rdS | j|ƒ}|| jjkS )NF)rb   Ú
isinstanceÚ_fips_hashesr–   r^   rv   )rm   rŒ   r•   rW   rW   rX   Úhash_supportedB  s    
zBackend.hash_supportedc             C   s    | j rt|tjƒrdS | j|ƒS )NF)rb   r˜   r"   ÚSHA1rš   )rm   rŒ   rW   rW   rX   Úsignature_hash_supportedI  s    z Backend.signature_hash_supportedc             C   s   | j r
dS | jjdkS d S )NFrZ   )rb   r`   ZCryptography_HAS_SCRYPT)rm   rW   rW   rX   Úscrypt_supportedR  s    zBackend.scrypt_supportedc             C   s    | j rt|tjƒrdS | j|ƒS )NT)rb   r˜   r"   r›   rš   )rm   rŒ   rW   rW   rX   Úhmac_supportedX  s    zBackend.hmac_supportedc             C   s
   t | |ƒS )N)r   )rm   rŒ   rW   rW   rX   Úcreate_hash_ctx_  s    zBackend.create_hash_ctx)Úcipherrx   r[   c             C   s^   | j rt|| jƒsdS y| jt|ƒt|ƒf }W n tk
rD   dS X || ||ƒ}| jj|kS )NF)rb   r˜   Ú_fips_ciphersrc   ÚtypeÚKeyErrorr^   rv   )rm   r    rx   ÚadapterÚ
evp_cipherrW   rW   rX   Úcipher_supportedd  s    zBackend.cipher_supportedc             C   s0   ||f| j krtdj||ƒƒ‚|| j ||f< d S )Nz"Duplicate registration for: {} {}.)rc   Ú
ValueErrorro   )rm   Ú
cipher_clsÚmode_clsr¤   rW   rW   rX   Úregister_cipher_adapterr  s
    
zBackend.register_cipher_adapterc             C   sÈ  x@t ttgD ]2}x,ttttttt	gD ]}| j
||tdƒƒ q$W qW x(tttttgD ]}| j
t|tdƒƒ qRW x&ttttgD ]}| j
t|tdƒƒ qzW | j
tttdƒƒ | j
ttd ƒtdƒƒ | j
t ttƒ x(tttttgD ]}| j
t|tdƒƒ qÚW | jj�s
| jj �rÄx(ttttgD ]}| j
t|tdƒƒ �qW x(ttttgD ]}| j
t|tdƒƒ �qBW x8tjttgttttgƒD ]\}}| j
||tdƒƒ �qxW | j
ttd ƒtd	ƒƒ | j
ttd ƒtd
ƒƒ d S )Nz+{cipher.name}-{cipher.key_size}-{mode.name}zdes-ede3-{mode.name}zdes-ede3Zchacha20zsm4-{mode.name}zbf-{mode.name}zseed-{mode.name}z{cipher.name}-{mode.name}Zrc4Zrc2)r5   r6   r7   rA   rD   rE   rG   rB   rC   rF   rª   ÚGetCipherByNamer:   r<   r;   r¢   rH   Ú_get_xts_cipherr9   r\   rq   r`   Ú#CRYPTOGRAPHY_OPENSSL_300_OR_GREATERr=   r@   Ú	itertoolsÚproductr>   r?   r8   rS   )rm   r¨   r©   rW   rW   rX   rd   {  s\    
z!Backend._register_default_ciphersc             C   s   t | ||t jƒS )N)r   Z_ENCRYPT)rm   r    rx   rW   rW   rX   Úcreate_symmetric_encryption_ctx¿  s    z'Backend.create_symmetric_encryption_ctxc             C   s   t | ||t jƒS )N)r   Z_DECRYPT)rm   r    rx   rW   rW   rX   Úcreate_symmetric_decryption_ctxÄ  s    z'Backend.create_symmetric_decryption_ctxc             C   s
   | j |ƒS )N)rž   )rm   rŒ   rW   rW   rX   Úpbkdf2_hmac_supportedÉ  s    zBackend.pbkdf2_hmac_supported)rŒ   ÚlengthÚsaltÚ
iterationsÚkey_materialr[   c       
   	   C   sh   | j jd|ƒ}| j|ƒ}| j j|ƒ}| jj|t|ƒ|t|ƒ||||ƒ}	| j|	dkƒ | j j|ƒd d … S )Nzunsigned char[]rZ   )	r^   rƒ   r—   Úfrom_bufferr`   ZPKCS5_PBKDF2_HMACr„   ru   Úbuffer)
rm   rŒ   r³   r´   rµ   r¶   r‡   r•   Úkey_material_ptrr~   rW   rW   rX   Úderive_pbkdf2_hmacÌ  s    
zBackend.derive_pbkdf2_hmacc             C   s   t jƒ S )N)Úrust_opensslZcapture_error_stack)rm   rW   rW   rX   Ú_consume_errorsä  s    zBackend._consume_errorsc             C   sz   || j jkst‚| j| jj|ƒ ƒ | jj|ƒ}| j jd|ƒ}| jj||ƒ}| j|dkƒ t	j
| j j|ƒd |… dƒ}|S )Nzunsigned char[]r   Úbig)r^   rv   rz   ru   r`   ZBN_is_negativeZBN_num_bytesrƒ   Z	BN_bn2binÚintÚ
from_bytesr¸   )rm   ÚbnZbn_num_bytesZbin_ptrZbin_lenÚvalrW   rW   rX   Ú
_bn_to_intç  s    zBackend._bn_to_int)Únumc             C   sn   |dks|| j jkst‚|dkr(| j j}|jt|jƒ d d ƒdƒ}| jj|t|ƒ|ƒ}| j	|| j jkƒ |S )a
  
        Converts a python integer to a BIGNUM. The returned BIGNUM will not
        be garbage collected (to support adding them to structs that take
        ownership of the object). Be sure to register it for GC if it will
        be discarded after use.
        Ng       @rZ   r½   )
r^   rv   rz   Úto_bytesr¾   Ú
bit_lengthr`   Z	BN_bin2bnr„   ru   )rm   rÃ   rÀ   ÚbinaryZbn_ptrrW   rW   rX   Ú
_int_to_bnó  s    zBackend._int_to_bn)Úpublic_exponentÚkey_sizer[   c             C   s”   t j||ƒ | jjƒ }| j|| jjkƒ | jj|| jjƒ}| j	|ƒ}| jj|| jj
ƒ}| jj|||| jjƒ}| j|dkƒ | j|ƒ}t| ||dd�S )NrZ   T)Úunsafe_skip_rsa_key_validation)r*   Z_verify_rsa_parametersr`   ÚRSA_newru   r^   rv   ÚgcÚRSA_freerÇ   ÚBN_freeZRSA_generate_key_exÚ_rsa_cdata_to_evp_pkeyr   )rm   rÈ   rÉ   Ú	rsa_cdatarÀ   r~   Úevp_pkeyrW   rW   rX   Úgenerate_rsa_private_key  s    


z Backend.generate_rsa_private_keyc             C   s   |dko|d@ dko|dkS )Né   rZ   r   i   rW   )rm   rÈ   rÉ   rW   rW   rX   Ú!generate_rsa_parameters_supported  s    z)Backend.generate_rsa_parameters_supported)ÚnumbersrÊ   r[   c          	   C   s6  t j|j|j|j|j|j|j|jj	|jj
ƒ | jjƒ }| j|| jjkƒ | jj|| jjƒ}| j|jƒ}| j|jƒ}| j|jƒ}| j|jƒ}| j|jƒ}| j|jƒ}	| j|jj	ƒ}
| j|jj
ƒ}| jj|||ƒ}| j|dkƒ | jj|||
|ƒ}| j|dkƒ | jj||||	ƒ}| j|dkƒ | j|ƒ}t| |||d�S )NrZ   )rÊ   )r*   Z_check_private_key_componentsÚpÚqÚdÚdmp1Údmq1ÚiqmpÚpublic_numbersr}   Únr`   rË   ru   r^   rv   rÌ   rÍ   rÇ   ZRSA_set0_factorsÚRSA_set0_keyZRSA_set0_crt_paramsrÏ   r   )rm   rÕ   rÊ   rÐ   rÖ   r×   rØ   rÙ   rÚ   rÛ   r}   rÝ   r~   rÑ   rW   rW   rX   Úload_rsa_private_numbers$  s@    


z Backend.load_rsa_private_numbers)rÕ   r[   c             C   s�   t j|j|jƒ | jjƒ }| j|| jjkƒ | jj	|| jj
ƒ}| j|jƒ}| j|jƒ}| jj|||| jjƒ}| j|dkƒ | j|ƒ}t| ||ƒS )NrZ   )r*   Z_check_public_key_componentsr}   rÝ   r`   rË   ru   r^   rv   rÌ   rÍ   rÇ   rÞ   rÏ   r   )rm   rÕ   rÐ   r}   rÝ   r~   rÑ   rW   rW   rX   Úload_rsa_public_numbersM  s    

zBackend.load_rsa_public_numbersc             C   s2   | j jƒ }| j|| jjkƒ | jj|| j jƒ}|S )N)r`   ZEVP_PKEY_newru   r^   rv   rÌ   ÚEVP_PKEY_free)rm   rÑ   rW   rW   rX   Ú_create_evp_pkey_gc\  s    
zBackend._create_evp_pkey_gcc             C   s(   | j ƒ }| jj||ƒ}| j|dkƒ |S )NrZ   )râ   r`   ZEVP_PKEY_set1_RSAru   )rm   rÐ   rÑ   r~   rW   rW   rX   rÏ   b  s    zBackend._rsa_cdata_to_evp_pkey)Údatar[   c             C   sH   | j j|ƒ}| jj|t|ƒƒ}| j|| j jkƒ t| j j|| jj	ƒ|ƒS )z®
        Return a _MemoryBIO namedtuple of (BIO, char*).

        The char* is the storage for the BIO and it must stay alive until the
        BIO is finished with.
        )
r^   r·   r`   ZBIO_new_mem_bufr„   ru   rv   rQ   rÌ   ÚBIO_free)rm   rã   Údata_ptrrR   rW   rW   rX   Ú_bytes_to_bioh  s    zBackend._bytes_to_bioc             C   sP   | j jƒ }| j|| jjkƒ | j j|ƒ}| j|| jjkƒ | jj|| j jƒ}|S )z.
        Creates an empty memory BIO.
        )r`   Z	BIO_s_memru   r^   rv   ZBIO_newrÌ   rä   )rm   Z
bio_methodrR   rW   rW   rX   Ú_create_mem_bio_gcu  s    
zBackend._create_mem_bio_gcc             C   s\   | j jdƒ}| jj||ƒ}| j|dkƒ | j|d | j jkƒ | j j|d |ƒdd… }|S )zE
        Reads a memory BIO. This only works on memory BIOs.
        zchar **r   N)r^   rƒ   r`   ZBIO_get_mem_dataru   rv   r¸   )rm   rR   r‡   Zbuf_lenÚbio_datarW   rW   rX   Ú_read_mem_bio€  s    zBackend._read_mem_bio)rÊ   r[   c       
      C   sV  | j j|ƒ}|| j jkrX| j j|ƒ}| j|| jjkƒ | jj|| j jƒ}t	| |||d�S || j j
krì| j j rì| j j rì| j j rì| j j|ƒ}| j|| jjkƒ | jj|| j jƒ}| jƒ }| j j||ƒ}| j|dkƒ | j| j|ƒd|d�S || j jk�r6| j j|ƒ}| j|| jjkƒ | jj|| j jƒ}t| ||ƒS || j jk�r€| j j|ƒ}| j|| jjkƒ | jj|| j jƒ}t| ||ƒS || jk�rÈ| j j|ƒ}	| j|	| jjkƒ | jj|	| j jƒ}	t| |	|ƒS |t| j ddƒk�ræt| |ƒS |t| j ddƒk�rt | |ƒS || j j!k�r,t"j#j$t%| jj&d|ƒƒƒS |t| j ddƒk�rJt'| |ƒS t(d	ƒ‚dS )
zd
        Return the appropriate type of PrivateKey given an evp_pkey cdata
        pointer.
        )rÊ   rZ   N)ÚpasswordrÊ   ÚEVP_PKEY_ED25519ÚEVP_PKEY_X448Ú	uintptr_tÚEVP_PKEY_ED448zUnsupported key type.))r`   ÚEVP_PKEY_idÚEVP_PKEY_RSAÚEVP_PKEY_get1_RSAru   r^   rv   rÌ   rÍ   r   ÚEVP_PKEY_RSA_PSSÚCRYPTOGRAPHY_IS_LIBRESSLÚCRYPTOGRAPHY_IS_BORINGSSLÚ#CRYPTOGRAPHY_OPENSSL_LESS_THAN_111Erç   Úi2d_RSAPrivateKey_bioÚload_der_private_keyré   ÚEVP_PKEY_DSAÚEVP_PKEY_get1_DSAÚDSA_freer   ÚEVP_PKEY_ECÚEVP_PKEY_get1_EC_KEYÚEC_KEY_freer   rj   ÚEVP_PKEY_get1_DHÚDH_freer   Úgetattrr   r   ÚEVP_PKEY_X25519r»   r,   Zprivate_key_from_ptrr¾   Úcastr   r   )
rm   rÑ   rÊ   Úkey_typerÐ   rR   r~   Ú	dsa_cdataÚec_cdataÚdh_cdatarW   rW   rX   Ú_evp_pkey_to_private_key‹  sb    





z Backend._evp_pkey_to_private_keyc       
      C   sZ  | j j|ƒ}|| j jkrT| j j|ƒ}| j|| jjkƒ | jj|| j jƒ}t	| ||ƒS || j j
krâ| j j râ| j j râ| j j râ| j j|ƒ}| j|| jjkƒ | jj|| j jƒ}| jƒ }| j j||ƒ}| j|dkƒ | j| j|ƒƒS || j jk�r,| j j|ƒ}| j|| jjkƒ | jj|| j jƒ}t| ||ƒS || j jk�r„| j j|ƒ}|| jjk�rf| jƒ }td|ƒ‚| jj|| j jƒ}t| ||ƒS || jk�rÌ| j j|ƒ}	| j|	| jjkƒ | jj|	| j jƒ}	t| |	|ƒS |t | j ddƒk�rêt!| |ƒS |t | j ddƒk�rt"| |ƒS || j j#k�r0t$j%j&t'| jj(d|ƒƒƒS |t | j ddƒk�rNt)| |ƒS t*dƒ‚dS )	zc
        Return the appropriate type of PublicKey given an evp_pkey cdata
        pointer.
        rZ   zUnable to load EC keyrë   Nrì   rí   rî   zUnsupported key type.)+r`   rï   rð   rñ   ru   r^   rv   rÌ   rÍ   r   rò   ró   rô   rõ   rç   Úi2d_RSAPublicKey_bioÚload_der_public_keyré   rø   rù   rú   r   rû   rü   r¼   r§   rý   r   rj   rþ   rÿ   r   r   r   r   r  r»   r,   Zpublic_key_from_ptrr¾   r  r   r   )
rm   rÑ   r  rÐ   rR   r~   r  r  rt   r  rW   rW   rX   Ú_evp_pkey_to_public_keyÓ  sX    






zBackend._evp_pkey_to_public_keyc             C   s4   | j rt|tjƒrdS t|tjtjtjtjtjfƒS )NF)rb   r˜   r"   r›   ÚSHA224ÚSHA256ÚSHA384ÚSHA512)rm   rŒ   rW   rW   rX   Ú_oaep_hash_supported  s    zBackend._oaep_hash_supported)Úpaddingr[   c             C   s†   t |tƒrdS t |tƒrNt |jtƒrN| jr>t |jjtjƒr>dS | j	|jjƒS n4t |t
ƒr~t |jtƒr~| j|jjƒo|| j|jƒS dS d S )NTF)r˜   r0   r/   Z_mgfr-   rb   Ú
_algorithmr"   r›   rš   r.   r  )rm   r  rW   rW   rX   Úrsa_padding_supported  s    

zBackend.rsa_padding_supportedc             C   s"   | j rt|tƒrdS | j|ƒS d S )NF)rb   r˜   r0   r  )rm   r  rW   rW   rX   Úrsa_encryption_supported0  s    z Backend.rsa_encryption_supported)rÉ   r[   c             C   s~   |dkrt dƒ‚| jjƒ }| j|| jjkƒ | jj|| jjƒ}| jj||| jjd| jj| jj| jjƒ}| j|dkƒ t	| |ƒS )	Né   é   é   é   z0Key size must be 1024, 2048, 3072, or 4096 bits.r   rZ   )r  r  r  r  )
r§   r`   ÚDSA_newru   r^   rv   rÌ   rú   ZDSA_generate_parameters_exr   )rm   rÉ   Úctxr~   rW   rW   rX   Úgenerate_dsa_parameters6  s     

zBackend.generate_dsa_parameters)Ú
parametersr[   c             C   sT   | j j|jƒ}| j|| jjkƒ | jj|| j jƒ}| j j|ƒ | j	|ƒ}t
| ||ƒS )N)r`   ZDSAparams_dupZ
_dsa_cdataru   r^   rv   rÌ   rú   ZDSA_generate_keyÚ_dsa_cdata_to_evp_pkeyr   )rm   r  r  rÑ   rW   rW   rX   Úgenerate_dsa_private_keyN  s    
z Backend.generate_dsa_private_keyc             C   s   | j |ƒ}| j|ƒS )N)r  r  )rm   rÉ   r  rW   rW   rX   Ú'generate_dsa_private_key_and_parameters[  s    
z/Backend.generate_dsa_private_key_and_parametersc             C   sB   | j j||||ƒ}| j|dkƒ | j j|||ƒ}| j|dkƒ d S )NrZ   )r`   ÚDSA_set0_pqgru   ZDSA_set0_key)rm   r  rÖ   r×   ÚgÚpub_keyÚpriv_keyr~   rW   rW   rX   Ú_dsa_cdata_set_valuesa  s    zBackend._dsa_cdata_set_valuesc       
      C   s¨   t j|ƒ |jj}| jjƒ }| j|| jjkƒ | jj	|| jj
ƒ}| j|jƒ}| j|jƒ}| j|jƒ}| j|jjƒ}| j|jƒ}| j||||||ƒ | j|ƒ}	t| ||	ƒS )N)r&   Z_check_dsa_private_numbersrÜ   Úparameter_numbersr`   r  ru   r^   rv   rÌ   rú   rÇ   rÖ   r×   r   ÚyÚxr#  r  r   )
rm   rÕ   r$  r  rÖ   r×   r   r!  r"  rÑ   rW   rW   rX   Úload_dsa_private_numbersi  s    


z Backend.load_dsa_private_numbersc       	      C   s¢   t j|jƒ | jjƒ }| j|| jjkƒ | jj|| jj	ƒ}| j
|jjƒ}| j
|jjƒ}| j
|jjƒ}| j
|jƒ}| jj}| j||||||ƒ | j|ƒ}t| ||ƒS )N)r&   Ú_check_dsa_parametersr$  r`   r  ru   r^   rv   rÌ   rú   rÇ   rÖ   r×   r   r%  r#  r  r   )	rm   rÕ   r  rÖ   r×   r   r!  r"  rÑ   rW   rW   rX   Úload_dsa_public_numbers~  s    

zBackend.load_dsa_public_numbersc             C   s†   t j|ƒ | jjƒ }| j|| jjkƒ | jj|| jjƒ}| j	|j
ƒ}| j	|jƒ}| j	|jƒ}| jj||||ƒ}| j|dkƒ t| |ƒS )NrZ   )r&   r(  r`   r  ru   r^   rv   rÌ   rú   rÇ   rÖ   r×   r   r  r   )rm   rÕ   r  rÖ   r×   r   r~   rW   rW   rX   Úload_dsa_parameter_numbers‘  s    

z"Backend.load_dsa_parameter_numbersc             C   s(   | j ƒ }| jj||ƒ}| j|dkƒ |S )NrZ   )râ   r`   ZEVP_PKEY_set1_DSAru   )rm   r  rÑ   r~   rW   rW   rX   r  ¡  s    zBackend._dsa_cdata_to_evp_pkeyc             C   s   | j  S )N)rb   )rm   rW   rW   rX   Údsa_supported§  s    zBackend.dsa_supportedc             C   s   | j ƒ sdS | j|ƒS )NF)r+  rœ   )rm   rŒ   rW   rW   rX   Údsa_hash_supportedª  s    zBackend.dsa_hash_supportedc             C   s   | j |td|j ƒƒS )Nó    )r¦   rA   Ú
block_size)rm   rŒ   rW   rW   rX   Úcmac_algorithm_supported¯  s    z Backend.cmac_algorithm_supportedc             C   s
   t | |ƒS )N)r	   )rm   rŒ   rW   rW   rX   Úcreate_cmac_ctx´  s    zBackend.create_cmac_ctx)rã   rê   rÊ   r[   c             C   s   | j | jj|||ƒS )N)Ú	_load_keyr`   ZPEM_read_bio_PrivateKey)rm   rã   rê   rÊ   rW   rW   rX   Úload_pem_private_key·  s
    zBackend.load_pem_private_keyc             C   sî   | j |ƒ}| jjdƒ}| jj|j| jj| jj| jjdƒ|ƒ}|| jjkrd| jj	|| jj
ƒ}| j|ƒS | jƒ  | jj|jƒ}| j|dkƒ | jj|j| jj| jj| jjdƒ|ƒ}|| jjkrâ| jj	|| jjƒ}| j|ƒ}t| ||ƒS | jƒ  d S )NzCRYPTOGRAPHY_PASSWORD_DATA *ÚCryptography_pem_password_cbrZ   )ræ   r^   rƒ   r`   ZPEM_read_bio_PUBKEYrR   rv   Ú	addressofÚ_original_librÌ   rá   r
  r¼   Ú	BIO_resetru   ZPEM_read_bio_RSAPublicKeyrÍ   rÏ   r   Ú_handle_key_loading_error)rm   rã   Úmem_bioÚuserdatarÑ   r~   rÐ   rW   rW   rX   Úload_pem_public_keyÄ  s2    




zBackend.load_pem_public_keyc             C   s^   | j |ƒ}| jj|j| jj| jj| jjƒ}|| jjkrR| jj|| jjƒ}t| |ƒS | j	ƒ  d S )N)
ræ   r`   ZPEM_read_bio_DHparamsrR   r^   rv   rÌ   rÿ   r   r7  )rm   rã   r8  r  rW   rW   rX   Úload_pem_parametersî  s    

zBackend.load_pem_parametersc             C   s>   | j |ƒ}| j||ƒ}|r&| j||ƒS | j| jj|||ƒS d S )N)ræ   Ú"_evp_pkey_from_der_traditional_keyr  r1  r`   Zd2i_PKCS8PrivateKey_bio)rm   rã   rê   rÊ   rè   r‹   rW   rW   rX   r÷   ú  s    

zBackend.load_der_private_keyc             C   sV   | j j|j| jjƒ}|| jjkrF| jj|| j jƒ}|d k	rBtdƒ‚|S | jƒ  d S d S )Nz4Password was given but private key is not encrypted.)	r`   Zd2i_PrivateKey_biorR   r^   rv   rÌ   rá   Ú	TypeErrorr¼   )rm   rè   rê   r‹   rW   rW   rX   r<    s    z*Backend._evp_pkey_from_der_traditional_keyc             C   s¾   | j |ƒ}| jj|j| jjƒ}|| jjkrF| jj|| jjƒ}| j|ƒS | j	ƒ  | jj
|jƒ}| j|dkƒ | jj|j| jjƒ}|| jjkr²| jj|| jjƒ}| j|ƒ}t| ||ƒS | jƒ  d S )NrZ   )ræ   r`   Zd2i_PUBKEY_biorR   r^   rv   rÌ   rá   r
  r¼   r6  ru   Zd2i_RSAPublicKey_biorÍ   rÏ   r   r7  )rm   rã   r8  rÑ   r~   rÐ   rW   rW   rX   r	  "  s    


zBackend.load_der_public_keyc             C   sº   | j |ƒ}| jj|j| jjƒ}|| jjkrF| jj|| jjƒ}t| |ƒS | jj	r®| j
ƒ  | jj|jƒ}| j|dkƒ | jj|j| jjƒ}|| jjkr®| jj|| jjƒ}t| |ƒS | jƒ  d S )NrZ   )ræ   r`   Zd2i_DHparams_biorR   r^   rv   rÌ   rÿ   r   rk   r¼   r6  ru   Zd2i_DHxparams_bior7  )rm   rã   r8  r  r~   rW   rW   rX   Úload_der_parameters9  s    


zBackend.load_der_parameters)Úcertr[   c             C   sT   |j tjjƒ}| j|ƒ}| jj|j| jj	ƒ}| j
|| jj	kƒ | jj|| jjƒ}|S )N)Zpublic_bytesr#   ÚEncodingÚDERræ   r`   Zd2i_X509_biorR   r^   rv   ru   rÌ   Ú	X509_free)rm   r?  rã   r8  r   rW   rW   rX   Ú
_cert2osslK  s    
zBackend._cert2ossl)Úx509_ptrr[   c             C   s4   | j ƒ }| jj||ƒ}| j|dkƒ tj| j|ƒƒS )NrZ   )rç   r`   Zi2d_X509_bioru   r   Zload_der_x509_certificateré   )rm   rD  rR   r~   rW   rW   rX   Ú
_ossl2certS  s    zBackend._ossl2certc             C   s"   | j j|j|jƒdkrtdƒ‚d S )NrZ   zKeys do not correspond)r`   ZEVP_PKEY_cmpÚ	_evp_pkeyr§   )rm   Úkey1Úkey2rW   rW   rX   Ú_check_keys_correspondY  s    zBackend._check_keys_correspondc       	      C   s"  | j |ƒ}| jjdƒ}|d k	rFtjd|ƒ | jj|ƒ}||_t|ƒ|_||j	| jj
| jj| jjdƒ|ƒ}|| jj
krÆ|jdkr¾| jƒ  |jd
krštdƒ‚qÆ|jdks¨t‚tdj|jd ƒƒ‚n| jƒ  | jj|| jjƒ}|d k	rò|jdkròtd	ƒ‚|d k	�r|jdk�s|d k�st‚| j||ƒS )NzCRYPTOGRAPHY_PASSWORD_DATA *rê   r3  r   rZ   z3Password was not given but private key is encryptedé   zAPasswords longer than {} bytes are not supported by this backend.z4Password was given but private key is not encrypted.éÿÿÿÿéþÿÿÿ)ræ   r^   rƒ   r   Ú_check_bytesliker·   rê   r„   r³   rR   rv   r4  r`   r5  Úerrorr¼   r=  rz   r§   ro   Úmaxsizer7  rÌ   rá   Úcalledr  )	rm   Zopenssl_read_funcrã   rê   rÊ   r8  r9  Zpassword_ptrrÑ   rW   rW   rX   r1  ]  s@    




zBackend._load_keyc                sž   ˆ j ƒ }|stdƒ‚n„|d jˆ jjˆ jjƒsf|d jˆ jjˆ jjƒsfˆ jjrp|d jˆ jj	ˆ jj
ƒrptdƒ‚n*t‡ fdd„|D ƒƒr�tdƒ‚n
td|ƒ‚d S )Nz|Could not deserialize key data. The data may be in an incorrect format or it may be encrypted with an unsupported algorithm.r   z Bad decrypt. Incorrect password?c             3   s"   | ]}|j ˆ jjˆ jjƒV  qd S )N)Ú_lib_reason_matchr`   ÚERR_LIB_EVPZ'EVP_R_UNSUPPORTED_PRIVATE_KEY_ALGORITHM)Ú.0rN  )rm   rW   rX   ú	<genexpr>®  s   z4Backend._handle_key_loading_error.<locals>.<genexpr>z!Unsupported public key algorithm.zÊCould not deserialize key data. The data may be in an incorrect format, it may be encrypted with an unsupported algorithm, or it may be an unsupported key type (e.g. EC curves with explicit parameters).)r¼   r§   rQ  r`   rR  ZEVP_R_BAD_DECRYPTZERR_LIB_PKCS12Z!PKCS12_R_PKCS12_CIPHERFINAL_ERRORZCryptography_HAS_PROVIDERSZERR_LIB_PROVZPROV_R_BAD_DECRYPTÚany)rm   rt   rW   )rm   rX   r7  ‘  s*    





z!Backend._handle_key_loading_error)Úcurver[   c             C   sv   y| j |ƒ}W n tk
r*   | jj}Y nX | jj|ƒ}|| jjkrP| jƒ  dS | j|| jjkƒ | jj	|ƒ dS d S )NFT)
Ú_elliptic_curve_to_nidr   r`   Ú	NID_undefZEC_GROUP_new_by_curve_namer^   rv   r¼   ru   ZEC_GROUP_free)rm   rV  Ú	curve_nidÚgrouprW   rW   rX   Úelliptic_curve_supported¿  s    z Backend.elliptic_curve_supported)Úsignature_algorithmrV  r[   c             C   s   t |tjƒsdS | j|ƒS )NF)r˜   r'   ZECDSAr[  )rm   r\  rV  rW   rW   rX   Ú,elliptic_curve_signature_algorithm_supportedÏ  s    z4Backend.elliptic_curve_signature_algorithm_supportedc             C   s^   | j |ƒrD| j|ƒ}| jj|ƒ}| j|dkƒ | j|ƒ}t| ||ƒS td|j› d�t	j
ƒ‚dS )z@
        Generate a new private key on the named curve.
        rZ   z Backend object does not support Ú.N)r[  Ú_ec_key_new_by_curver`   ZEC_KEY_generate_keyru   Ú_ec_cdata_to_evp_pkeyr   r   r‘   r   ÚUNSUPPORTED_ELLIPTIC_CURVE)rm   rV  r  r~   rÑ   rW   rW   rX   Ú#generate_elliptic_curve_private_keyÚ  s    


z+Backend.generate_elliptic_curve_private_keyc             C   sH  |j }| j|jƒ}| jj| j|jƒ| jjƒ}| jj	||ƒ}|dkrR| j
ƒ  tdƒ‚| jƒ �Ò}| j||j|j|ƒ | jj|ƒ}| j|| jjkƒ tjj|ƒ}| j|| jjkƒ | jj|ƒ}	| j|	| jjkƒ | jj|	| jjƒ}	| jj||	|| jj| jj|ƒ}| j|dkƒ | jj|||	|ƒdk�r(tdƒ‚W d Q R X | j|ƒ}
t| ||
ƒS )NrZ   zInvalid EC key.r   )rÜ   r_  rV  r^   rÌ   rÇ   Úprivate_valuer`   ÚBN_clear_freeÚEC_KEY_set_private_keyr¼   r§   Ú_tmp_bn_ctxÚ)_ec_key_set_public_key_affine_coordinatesr&  r%  ÚEC_KEY_get0_groupru   rv   ÚbackendZEC_KEY_get0_public_keyÚEC_POINT_newÚEC_POINT_freeÚEC_POINT_mulZEC_POINT_cmpr`  r   )rm   rÕ   Úpublicr  rc  r~   Úbn_ctxrZ  Z	set_pointZcomputed_pointrÑ   rW   rW   rX   Ú#load_elliptic_curve_private_numbersð  sB    


z+Backend.load_elliptic_curve_private_numbersc             C   sJ   | j |jƒ}| jƒ �}| j||j|j|ƒ W d Q R X | j|ƒ}t| ||ƒS )N)r_  rV  rf  rg  r&  r%  r`  r   )rm   rÕ   r  rn  rÑ   rW   rW   rX   Ú"load_elliptic_curve_public_numbers$  s    

z*Backend.load_elliptic_curve_public_numbers)rV  Úpoint_bytesr[   c       	      C   sÎ   | j |ƒ}| jj|ƒ}| j|| jjkƒ | jj|ƒ}| j|| jjkƒ | jj|| jjƒ}| j	ƒ �6}| jj
|||t|ƒ|ƒ}|dkr’| jƒ  tdƒ‚W d Q R X | jj||ƒ}| j|dkƒ | j|ƒ}t| ||ƒS )NrZ   z(Invalid public bytes for the given curve)r_  r`   rh  ru   r^   rv   rj  rÌ   rk  rf  ZEC_POINT_oct2pointr„   r¼   r§   ÚEC_KEY_set_public_keyr`  r   )	rm   rV  rq  r  rZ  Úpointrn  r~   rÑ   rW   rW   rX   Ú load_elliptic_curve_public_bytes0  s     


z(Backend.load_elliptic_curve_public_bytes)rc  rV  r[   c             C   sb  | j |ƒ}| jj|ƒ}| j|| jjkƒ | jj|ƒ}| j|| jjkƒ | jj|| jjƒ}| j	|ƒ}| jj|| jj
ƒ}| jƒ �v}| jj|||| jj| jj|ƒ}| j|dkƒ | jj|ƒ}	| jj|ƒ}
| jj|||	|
|ƒ}|dkrî| jƒ  tdƒ‚W d Q R X | jj||ƒ}| j|dkƒ | j	|ƒ}| jj|| jj
ƒ}| jj||ƒ}| j|dkƒ | j|ƒ}t| ||ƒS )NrZ   z'Unable to derive key from private_value)r_  r`   rh  ru   r^   rv   rj  rÌ   rk  rÇ   rd  rf  rl  Z
BN_CTX_getZEC_POINT_get_affine_coordinatesr¼   r§   rr  re  r`  r   )rm   rc  rV  r  rZ  rs  Úvaluern  r~   Zbn_xZbn_yÚprivaterÑ   rW   rW   rX   Ú!derive_elliptic_curve_private_keyF  s6    




z)Backend.derive_elliptic_curve_private_key)rV  c             C   s   | j |ƒ}| j|ƒS )N)rW  Ú_ec_key_new_by_curve_nid)rm   rV  rY  rW   rW   rX   r_  p  s    
zBackend._ec_key_new_by_curve)rY  c             C   s0   | j j|ƒ}| j|| jjkƒ | jj|| j jƒS )N)r`   ZEC_KEY_new_by_curve_nameru   r^   rv   rÌ   rý   )rm   rY  r  rW   rW   rX   rx  t  s    z Backend._ec_key_new_by_curve_nid)rŒ   rV  r[   c             C   s.   | j rt|| jƒ rdS | j|ƒo,t|tjƒS )NF)rb   r˜   Ú_fips_ecdh_curvesr[  r'   ÚECDH)rm   rŒ   rV  rW   rW   rX   Ú+elliptic_curve_exchange_algorithm_supportedy  s
    z3Backend.elliptic_curve_exchange_algorithm_supportedc             C   s(   | j ƒ }| jj||ƒ}| j|dkƒ |S )NrZ   )râ   r`   ZEVP_PKEY_set1_EC_KEYru   )rm   r  rÑ   r~   rW   rW   rX   r`  …  s    zBackend._ec_cdata_to_evp_pkeyc             C   sN   dddœ}|j |j|jƒ}| jj|jƒ ƒ}|| jjkrJt|j› d�tjƒ‚|S )z/
        Get the NID for a curve name.
        Z
prime192v1Z
prime256v1)Z	secp192r1Z	secp256r1z" is not a supported elliptic curve)	Úgetr‘   r`   Z
OBJ_sn2nidr“   rX  r   r   ra  )rm   rV  Zcurve_aliasesZ
curve_namerY  rW   rW   rX   rW  ‹  s    

zBackend._elliptic_curve_to_nidc             c   sX   | j jƒ }| j|| jjkƒ | jj|| j jƒ}| j j|ƒ z
|V  W d | j j|ƒ X d S )N)	r`   Z
BN_CTX_newru   r^   rv   rÌ   ZBN_CTX_freeZBN_CTX_startZ
BN_CTX_end)rm   rn  rW   rW   rX   rf  œ  s    

zBackend._tmp_bn_ctx)r&  r%  r[   c             C   sâ   |dk s|dk rt dƒ‚| jj| j|ƒ| jjƒ}| jj| j|ƒ| jjƒ}| jj|ƒ}| j|| jjkƒ | jj	|ƒ}| j|| jjkƒ | jj|| jj
ƒ}| jj|||||ƒ}|dkrÂ| jƒ  t dƒ‚| jj||ƒ}| j|dkƒ dS )zg
        Sets the public key point in the EC_KEY context to the affine x and y
        values.
        r   z2Invalid EC key. Both x and y must be non-negative.rZ   zInvalid EC key.N)r§   r^   rÌ   rÇ   r`   rÎ   rh  ru   rv   rj  rk  ZEC_POINT_set_affine_coordinatesr¼   rr  )rm   r  r&  r%  rn  rZ  rs  r~   rW   rW   rX   rg  §  s"    z1Backend._ec_key_set_public_key_affine_coordinates)Úencodingro   Úencryption_algorithmr[   c       
      C   sd  t |tjƒstdƒ‚t |tjƒs(tdƒ‚t |tjƒs<tdƒ‚t |tjƒrNd}nbt |tjƒrv|j}t	|ƒdkr°t
dƒ‚n:t |tjƒr¨|j|  koštjjkn  r¨|j}nt
dƒ‚|tjjk�r |tjjkrÔ| jj}n|tjjkrê| jj}nt
dƒ‚| j|||ƒS |tjjk�r&| j�r.t |tjƒ �r.t
d	ƒ‚| jj|ƒ}	|tjjk�r¦|	| jjk�r`| jj}n8|	| jjk�rx| jj}n |	| jjk�r�| jj}nt
d
ƒ‚| j|||ƒS |tjjk�r|�rÂt
dƒ‚|	| jjk�rÚ| jj}n8|	| jjk�rò| jj}n |	| jjk�r
| jj }nt
d
ƒ‚| j!||ƒS t
dƒ‚|tjjk�rX|tjjk�rPt"j#|||ƒS t
dƒ‚t
dƒ‚d S )Nz/encoding must be an item from the Encoding enumz2format must be an item from the PrivateFormat enumzBEncryption algorithm must be a KeySerializationEncryption instanceó    iÿ  zBPasswords longer than 1023 bytes are not supported by this backendzUnsupported encryption typezUnsupported encoding for PKCS8zCEncrypted traditional OpenSSL format is not supported in FIPS mode.z+Unsupported key type for TraditionalOpenSSLzDEncryption is not supported for DER encoded traditional OpenSSL keysz+Unsupported encoding for TraditionalOpenSSLz=OpenSSH private key format can only be used with PEM encodingzformat is invalid with this key)$r˜   r#   r@  r=  ÚPrivateFormatÚKeySerializationEncryptionÚNoEncryptionÚBestAvailableEncryptionrê   r„   r§   Ú_KeySerializationEncryptionÚ_formatÚOpenSSHZPKCS8ÚPEMr`   ZPEM_write_bio_PKCS8PrivateKeyrA  Zi2d_PKCS8PrivateKey_bioÚ_private_key_bytes_via_bioZTraditionalOpenSSLrb   rï   rð   ZPEM_write_bio_RSAPrivateKeyrø   ZPEM_write_bio_DSAPrivateKeyrû   ZPEM_write_bio_ECPrivateKeyrö   Zi2d_ECPrivateKey_bioZi2d_DSAPrivateKey_bioÚ_bio_func_outputrK   Z_serialize_ssh_private_key)
rm   r}  ro   r~  r‹   rÑ   Úcdatarê   Ú	write_bior  rW   rW   rX   Ú_private_key_bytesÈ  sŒ    
















zBackend._private_key_bytesc             C   s<   |s| j j}n| jjdƒ}| j||||t|ƒ| j j| j jƒS )Ns   aes-256-cbc)r^   rv   r`   ÚEVP_get_cipherbynamer‰  r„   )rm   r‹  rÑ   rê   r¥   rW   rW   rX   rˆ  B  s    
z"Backend._private_key_bytes_via_bioc             G   s.   | j ƒ }||f|žŽ }| j|dkƒ | j|ƒS )NrZ   )rç   ru   ré   )rm   r‹  ÚargsrR   r~   rW   rW   rX   r‰  U  s    zBackend._bio_func_output)r}  ro   r[   c             C   s  t |tjƒstdƒ‚t |tjƒs(tdƒ‚|tjjkrt|tjjkrJ| jj}n|tjj	kr`| jj
}ntdƒ‚| j||ƒS |tjjkrà| jj|ƒ}|| jjkr tdƒ‚|tjjkr¶| jj}n|tjj	krÌ| jj}ntdƒ‚| j||ƒS |tjjk�r|tjjk�rtj|ƒS tdƒ‚tdƒ‚d S )Nz/encoding must be an item from the Encoding enumz1format must be an item from the PublicFormat enumz8SubjectPublicKeyInfo works only with PEM or DER encodingz+PKCS1 format is supported only for RSA keysz)PKCS1 works only with PEM or DER encodingz1OpenSSH format must be used with OpenSSH encodingzformat is invalid with this key)r˜   r#   r@  r=  ÚPublicFormatZSubjectPublicKeyInfor‡  r`   ZPEM_write_bio_PUBKEYrA  Zi2d_PUBKEY_bior§   r‰  ZPKCS1rï   rð   ZPEM_write_bio_RSAPublicKeyr  r†  rK   Zserialize_ssh_public_key)rm   r}  ro   r‹   rÑ   rŠ  r‹  r  rW   rW   rX   Ú_public_key_bytes[  s:    




zBackend._public_key_bytesc             C   s
   | j j S )N)r`   rô   )rm   rW   rW   rX   Údh_supported’  s    zBackend.dh_supported)Ú	generatorrÉ   r[   c             C   s’   |t jk rtdjt jƒƒ‚|dkr*tdƒ‚| jjƒ }| j|| jjkƒ | jj	|| jj
ƒ}| jj|||| jjƒ}|dkrˆ| jƒ }td|ƒ‚t| |ƒS )Nz$DH key_size must be at least {} bitsrJ  é   zDH generator must be 2 or 5rZ   z Unable to generate DH parameters)rJ  r“  )r%   Z_MIN_MODULUS_SIZEr§   ro   r`   ÚDH_newru   r^   rv   rÌ   rÿ   ZDH_generate_parameters_exr¼   r   )rm   r’  rÉ   Zdh_param_cdatar~   rt   rW   rW   rX   Úgenerate_dh_parameters•  s    



zBackend.generate_dh_parametersc             C   s(   | j ƒ }| jj||ƒ}| j|dkƒ |S )NrZ   )râ   r`   ZEVP_PKEY_set1_DHru   )rm   r  rÑ   r~   rW   rW   rX   Ú_dh_cdata_to_evp_pkey¯  s    zBackend._dh_cdata_to_evp_pkeyc             C   s<   t |j| ƒ}| jj|ƒ}| j|dkƒ | j|ƒ}t| ||ƒS )NrZ   )r
   Z	_dh_cdatar`   ZDH_generate_keyru   r–  r   )rm   r  Zdh_key_cdatar~   rÑ   rW   rW   rX   Úgenerate_dh_private_keyµ  s    

zBackend.generate_dh_private_keyc             C   s   | j | j||ƒƒS )N)r—  r•  )rm   r’  rÉ   rW   rW   rX   Ú&generate_dh_private_key_and_parametersÃ  s    z.Backend.generate_dh_private_key_and_parametersc             C   s@  |j j}| jjƒ }| j|| jjkƒ | jj|| jjƒ}| j	|j
ƒ}| j	|jƒ}|jd k	rf| j	|jƒ}n| jj}| j	|j jƒ}| j	|jƒ}| jj||||ƒ}	| j|	dkƒ | jj|||ƒ}	| j|	dkƒ | jjddƒ}
| jj||
ƒ}	| j|	dkƒ |
d dk�r*|jdk�o|
d | jjA dk �r*tdƒ‚| j|ƒ}t| ||ƒS )NrZ   zint[]r   rJ  z.DH private numbers did not pass safety checks.)rÜ   r$  r`   r”  ru   r^   rv   rÌ   rÿ   rÇ   rÖ   r   r×   r%  r&  ÚDH_set0_pqgÚDH_set0_keyrƒ   ÚDH_checkZDH_NOT_SUITABLE_GENERATORr§   r–  r   )rm   rÕ   r$  r  rÖ   r   r×   r!  r"  r~   ÚcodesrÑ   rW   rW   rX   Úload_dh_private_numbersÊ  s0    



zBackend.load_dh_private_numbersc       
      C   sÐ   | j jƒ }| j|| jjkƒ | jj|| j jƒ}|j}| j|j	ƒ}| j|j
ƒ}|jd k	rd| j|jƒ}n| jj}| j|jƒ}| j j||||ƒ}| j|dkƒ | j j||| jjƒ}| j|dkƒ | j|ƒ}	t| ||	ƒS )NrZ   )r`   r”  ru   r^   rv   rÌ   rÿ   r$  rÇ   rÖ   r   r×   r%  r™  rš  r–  r   )
rm   rÕ   r  r$  rÖ   r   r×   r!  r~   rÑ   rW   rW   rX   Úload_dh_public_numbersú  s     


zBackend.load_dh_public_numbersc             C   s�   | j jƒ }| j|| jjkƒ | jj|| j jƒ}| j|jƒ}| j|j	ƒ}|j
d k	r^| j|j
ƒ}n| jj}| j j||||ƒ}| j|dkƒ t| |ƒS )NrZ   )r`   r”  ru   r^   rv   rÌ   rÿ   rÇ   rÖ   r   r×   r™  r   )rm   rÕ   r  rÖ   r   r×   r~   rW   rW   rX   Úload_dh_parameter_numbers  s    

z!Backend.load_dh_parameter_numbers)rÖ   r   r×   r[   c             C   s´   | j jƒ }| j|| jjkƒ | jj|| j jƒ}| j|ƒ}| j|ƒ}|d k	rV| j|ƒ}n| jj}| j j||||ƒ}| j|dkƒ | jj	ddƒ}| j j
||ƒ}| j|dkƒ |d dkS )NrZ   zint[]r   )r`   r”  ru   r^   rv   rÌ   rÿ   rÇ   r™  rƒ   r›  )rm   rÖ   r   r×   r  r~   rœ  rW   rW   rX   Údh_parameters_supported+  s    


zBackend.dh_parameters_supportedc             C   s   | j jdkS )NrZ   )r`   rk   )rm   rW   rW   rX   Údh_x942_serialization_supportedC  s    z'Backend.dh_x942_serialization_supportedc             C   s   t jj|ƒS )N)r»   r,   Zfrom_public_bytes)rm   rã   rW   rW   rX   Úx25519_load_public_bytesF  s    z Backend.x25519_load_public_bytesc             C   s   t jj|ƒS )N)r»   r,   Zfrom_private_bytes)rm   rã   rW   rW   rX   Úx25519_load_private_bytesI  s    z!Backend.x25519_load_private_bytesc             C   s¨   | j j|| jjƒ}| j|| jjkƒ | jj|| j jƒ}| j j|ƒ}| j|dkƒ | jjdƒ}| j j	||ƒ}| j|dkƒ | j|d | jjkƒ | jj|d | j j
ƒ}|S )NrZ   zEVP_PKEY **r   )r`   ZEVP_PKEY_CTX_new_idr^   rv   ru   rÌ   ZEVP_PKEY_CTX_freeZEVP_PKEY_keygen_initrƒ   ZEVP_PKEY_keygenrá   )rm   ÚnidZevp_pkey_ctxr~   Z	evp_ppkeyrÑ   rW   rW   rX   Ú_evp_pkey_keygen_gcN  s    zBackend._evp_pkey_keygen_gcc             C   s
   t jjƒ S )N)r»   r,   Zgenerate_key)rm   rW   rW   rX   Úx25519_generate_key[  s    zBackend.x25519_generate_keyc             C   s   | j r
dS | jj S )NF)rb   r`   Z#CRYPTOGRAPHY_LIBRESSL_LESS_THAN_370)rm   rW   rW   rX   Úx25519_supported^  s    zBackend.x25519_supportedc             C   s`   t |ƒdkrtdƒ‚| jj| jj| jj|t |ƒƒ}| j|| jjkƒ | jj|| jj	ƒ}t
| |ƒS )Né8   z#An X448 public key is 56 bytes long)r„   r§   r`   ÚEVP_PKEY_new_raw_public_keyÚNID_X448r^   rv   ru   rÌ   rá   r   )rm   rã   rÑ   rW   rW   rX   Úx448_load_public_bytesc  s    zBackend.x448_load_public_bytesc             C   sl   t |ƒdkrtdƒ‚| jj|ƒ}| jj| jj| jj|t |ƒƒ}| j|| jjkƒ | jj	|| jj
ƒ}t| |ƒS )Nr¨  z$An X448 private key is 56 bytes long)r„   r§   r^   r·   r`   ÚEVP_PKEY_new_raw_private_keyrª  rv   ru   rÌ   rá   r   )rm   rã   rå   rÑ   rW   rW   rX   Úx448_load_private_bytesn  s    zBackend.x448_load_private_bytesc             C   s   | j | jjƒ}t| |ƒS )N)r¥  r`   rª  r   )rm   rÑ   rW   rW   rX   Úx448_generate_keyz  s    zBackend.x448_generate_keyc             C   s   | j r
dS | jj o| jj S )NF)rb   r`   ró   rô   )rm   rW   rW   rX   Úx448_supported~  s    
zBackend.x448_supportedc             C   s   | j r
dS | jjS )NF)rb   r`   Z CRYPTOGRAPHY_HAS_WORKING_ED25519)rm   rW   rW   rX   Úed25519_supported†  s    zBackend.ed25519_supportedc             C   sn   t jd|ƒ t|ƒtjkr"tdƒ‚| jj| jj| j	j
|t|ƒƒ}| j|| j	j
kƒ | j	j|| jjƒ}t| |ƒS )Nrã   z&An Ed25519 public key is 32 bytes long)r   Ú_check_bytesr„   r)   Ú_ED25519_KEY_SIZEr§   r`   r©  ÚNID_ED25519r^   rv   ru   rÌ   rá   r   )rm   rã   rÑ   rW   rW   rX   Úed25519_load_public_bytes‹  s    z!Backend.ed25519_load_public_bytesc             C   sz   t |ƒtjkrtdƒ‚tjd|ƒ | jj|ƒ}| jj	| jj
| jj|t |ƒƒ}| j|| jjkƒ | jj|| jjƒ}t| |ƒS )Nz'An Ed25519 private key is 32 bytes longrã   )r„   r)   r²  r§   r   rM  r^   r·   r`   r¬  r³  rv   ru   rÌ   rá   r   )rm   rã   rå   rÑ   rW   rW   rX   Úed25519_load_private_bytes›  s    z"Backend.ed25519_load_private_bytesc             C   s   | j | jjƒ}t| |ƒS )N)r¥  r`   r³  r   )rm   rÑ   rW   rW   rX   Úed25519_generate_key«  s    zBackend.ed25519_generate_keyc             C   s   | j r
dS | jj o| jj S )NF)rb   r`   Z#CRYPTOGRAPHY_OPENSSL_LESS_THAN_111Brô   )rm   rW   rW   rX   Úed448_supported¯  s    
zBackend.ed448_supportedc             C   sl   t jd|ƒ t|ƒtkr tdƒ‚| jj| jj| jj	|t|ƒƒ}| j
|| jj	kƒ | jj|| jjƒ}t| |ƒS )Nrã   z$An Ed448 public key is 57 bytes long)r   r±  r„   r   r§   r`   r©  Ú	NID_ED448r^   rv   ru   rÌ   rá   r   )rm   rã   rÑ   rW   rW   rX   Úed448_load_public_bytes·  s    zBackend.ed448_load_public_bytesc             C   sx   t jd|ƒ t|ƒtkr tdƒ‚| jj|ƒ}| jj| jj	| jj
|t|ƒƒ}| j|| jj
kƒ | jj|| jjƒ}t| |ƒS )Nrã   z%An Ed448 private key is 57 bytes long)r   rM  r„   r   r§   r^   r·   r`   r¬  r¸  rv   ru   rÌ   rá   r   )rm   rã   rå   rÑ   rW   rW   rX   Úed448_load_private_bytesÄ  s    z Backend.ed448_load_private_bytesc             C   s   | j | jjƒ}t| |ƒS )N)r¥  r`   r¸  r   )rm   rÑ   rW   rW   rX   Úed448_generate_keyÒ  s    zBackend.ed448_generate_key)r¶   r´   r³   rÝ   ÚrrÖ   r[   c             C   s†   | j jd|ƒ}| j j|ƒ}| jj|t|ƒ|t|ƒ|||tj||ƒ
}	|	dkrr| jƒ }
d| | d }t	dj
|ƒ|
ƒ‚| j j|ƒd d … S )Nzunsigned char[]rZ   é€   i   rJ  zJNot enough memory to derive key. These parameters require {} MB of memory.i   )r^   rƒ   r·   r`   ZEVP_PBE_scryptr„   rJ   Z
_MEM_LIMITr¼   ÚMemoryErrorro   r¸   )rm   r¶   r´   r³   rÝ   r¼  rÖ   r‡   r¹   r~   rt   Z
min_memoryrW   rW   rX   Úderive_scryptÖ  s*    	zBackend.derive_scryptc             C   sL   t j|ƒ}| jr|| jkrdS |jdƒr4| jjdkS | jj|ƒ| jj	kS d S )NFs   -sivrZ   )
r   Z_aead_cipher_namerb   Ú
_fips_aeadÚendswithr`   r­   r�  r^   rv   )rm   r    Úcipher_namerW   rW   rX   Úaead_cipher_supportedù  s    

zBackend.aead_cipher_supported)r³   r[   c             C   s   xt |ƒD ]}d||< q
W d S )Nr   )Úrange)rm   rã   r³   ÚirW   rW   rX   Ú
_zero_data  s    zBackend._zero_datac             c   sf   |dkr| j jV  nNt|ƒ}| j jd|d ƒ}| j j|||ƒ z
|V  W d| j| j jd|ƒ|ƒ X dS )aâ  
        This method takes bytes, which can be a bytestring or a mutable
        buffer like a bytearray, and yields a null-terminated version of that
        data. This is required because PKCS12_parse doesn't take a length with
        its password char * and ffi.from_buffer doesn't provide null
        termination. So, to support zeroing the data via bytearray we
        need to build this ridiculous construct that copies the memory, but
        zeroes it after use.
        Nzchar[]rZ   z	uint8_t *)r^   rv   r„   rƒ   ÚmemmoverÆ  r  )rm   rã   Zdata_lenr‡   rW   rW   rX   Ú_zeroed_null_terminated_buf  s    
z#Backend._zeroed_null_terminated_buf)rã   rê   r[   c             C   s2   | j ||ƒ}|j|jr|jjnd dd„ |jD ƒfS )Nc             S   s   g | ]
}|j ‘qS rW   )Úcertificate)rS  r?  rW   rW   rX   ú
<listcomp>0  s    zABackend.load_key_and_certificates_from_pkcs12.<locals>.<listcomp>)Úload_pkcs12r‹   r?  rÉ  Zadditional_certs)rm   rã   rê   Zpkcs12rW   rW   rX   Ú%load_key_and_certificates_from_pkcs12%  s    z-Backend.load_key_and_certificates_from_pkcs12c             C   sn  |d k	rt jd|ƒ | j|ƒ}| jj|j| jjƒ}|| jjkrN| jƒ  t	dƒ‚| jj
|| jjƒ}| jjdƒ}| jjdƒ}| jjdƒ}| j|ƒ�}| jj|||||ƒ}	W d Q R X |	dkrÆ| jƒ  t	dƒ‚d }
d }g }|d | jjk�r| jj
|d | jjƒ}| j|dd	�}|d | jjk�rt| jj
|d | jjƒ}| j|ƒ}d }| jj|| jjƒ}|| jjk�rj| jj|ƒ}t||ƒ}
|d | jjk�rb| jj
|d | jjƒ}| jj|d ƒ}| jj�sÀ| jj�rÊt|ƒ}ntt|ƒƒ}xŠ|D ]‚}| jj||ƒ}| j|| jjkƒ | jj
|| jjƒ}| j|ƒ}d }| jj|| jjƒ}|| jjk�rL| jj|ƒ}|jt||ƒƒ �qÜW t||
|ƒS )
Nrê   z!Could not deserialize PKCS12 datazEVP_PKEY **zX509 **zCryptography_STACK_OF_X509 **r   zInvalid password or PKCS12 dataF)rÊ   ) r   rM  ræ   r`   Zd2i_PKCS12_biorR   r^   rv   r¼   r§   rÌ   ÚPKCS12_freerƒ   rÈ  ZPKCS12_parserá   r  rB  rE  ZX509_alias_get0r…   rM   Úsk_X509_freeÚsk_X509_numr­   rô   rÄ  ÚreversedÚsk_X509_valueru   rl   rN   )rm   rã   rê   rR   Úp12Zevp_pkey_ptrrD  Zsk_x509_ptrÚpassword_bufr~   r?  r‹   Zadditional_certificatesrÑ   r   Zcert_objr‘   Z
maybe_nameÚsk_x509rÃ   ÚindicesrÅ  Z	addl_certZ	addl_namerW   rW   rX   rË  3  sf    








zBackend.load_pkcs12)r‘   r‹   r?  Úcasr~  r[   c             C   sh  d }|d k	rt jd|ƒ t|tjƒr@d}d	}d}	d}
| jj}�nBt|tjƒrŽ| jj	rf| jj
}| jj
}n| jj}| jj}d}	d}
| jj}|j}nôt|tjƒo¦|jtjjk�rzd}d}d}	d}
|j}|j}|tjkrâ| jj}| jj}n>|tjk�r| jj	�s tdƒ‚| jj
}| jj
}n|d k�s t‚|jd k	�r^| jj�s>tdƒ‚| j|jƒ}| j|| jjkƒ n| jj}|jd k	�r‚|j}	ntdƒ‚|d k�sšt|ƒdk�r¤| jj}nÂ| jjƒ }| jj|| jj ƒ}g }x |D ]˜}t|t!ƒ�r0|j"}| j#|j$ƒ}|d k�r| jj%|| jjd
ƒ}n| jj%||t|ƒƒ}| j|dkƒ n
| j#|ƒ}|j&|ƒ | jj'||ƒ}t(j|dkƒ �qÊW | j)|ƒ� }| j)|ƒ�V}|�rŽ| j#|ƒn| jj}|d k	�r¨|j*}n| jj}| jj+||||||||	|
dƒ
}W d Q R X | jj�r|| jjk�r| jj,||d| jjd|
|ƒ W d Q R X | j|| jjkƒ | jj|| jj-ƒ}| j.ƒ }| jj/||ƒ}| j|dkƒ | j0|ƒS )Nr‘   rZ   r   i N  z2PBESv2 is not supported by this version of OpenSSLzBSetting MAC algorithm is not supported by this version of OpenSSL.zUnsupported key encryption typerK  rK  rK  rK  )1r   r±  r˜   r#   r‚  r^   rv   rƒ  r`   r­   ZNID_aes_256_cbcZ&NID_pbe_WithSHA1And3_Key_TripleDES_CBCrê   r„  r…  r€  ZPKCS12Z_key_cert_algorithmrL   ZPBESv1SHA1And3KeyTripleDESCBCZPBESv2SHA256AndAES256CBCr   rz   Z
_hmac_hashZCryptography_HAS_PKCS12_SET_MACr—   ru   Z_kdf_roundsr§   r„   Zsk_X509_new_nullrÌ   rÎ  rM   Zfriendly_namerC  rÉ  ZX509_alias_set1rl   Zsk_X509_pushri  rÈ  rF  ZPKCS12_createZPKCS12_set_macrÍ  rç   Zi2d_PKCS12_bioré   )rm   r‘   r‹   r?  rÖ  r~  rê   Znid_certZnid_keyZpkcs12_iterZmac_iterZmac_algZ
keycertalgrÔ  Zossl_casÚcaZca_aliasZossl_car~   rÓ  Zname_bufZ	ossl_certrÑ   rÒ  rR   rW   rW   rX   Ú(serialize_key_and_certificates_to_pkcs12~  sÎ    















z0Backend.serialize_key_and_certificates_to_pkcs12c             C   s   | j r
dS | jjdkS )NFrZ   )rb   r`   ZCryptography_HAS_POLY1305)rm   rW   rW   rX   Úpoly1305_supported	  s    zBackend.poly1305_supported)r‹   r[   c             C   s*   t jd|ƒ t|ƒtkr tdƒ‚t| |ƒS )Nr‹   zA poly1305 key is 32 bytes long)r   rM  r„   r   r§   r   )rm   r‹   rW   rW   rX   Úcreate_poly1305_ctx"	  s    zBackend.create_poly1305_ctxc             C   s
   | j j S )N)r`   rô   )rm   rW   rW   rX   Úpkcs7_supported)	  s    zBackend.pkcs7_supportedc             C   sn   t jd|ƒ | j|ƒ}| jj|j| jj| jj| jjƒ}|| jjkrR| jƒ  t	dƒ‚| jj
|| jjƒ}| j|ƒS )Nrã   zUnable to parse PKCS7 data)r   r±  ræ   r`   ZPEM_read_bio_PKCS7rR   r^   rv   r¼   r§   rÌ   Ú
PKCS7_freeÚ_load_pkcs7_certificates)rm   rã   rR   Úp7rW   rW   rX   Úload_pem_pkcs7_certificates,	  s    
z#Backend.load_pem_pkcs7_certificatesc             C   sb   t jd|ƒ | j|ƒ}| jj|j| jjƒ}|| jjkrF| jƒ  t	dƒ‚| jj
|| jjƒ}| j|ƒS )Nrã   zUnable to parse PKCS7 data)r   r±  ræ   r`   Zd2i_PKCS7_biorR   r^   rv   r¼   r§   rÌ   rÜ  rÝ  )rm   rã   rR   rÞ  rW   rW   rX   Úload_der_pkcs7_certificates;	  s    
z#Backend.load_der_pkcs7_certificatesc       	      C   s¢   | j j|jƒ}| j|| j jkƒ || j jkr>tdj|ƒtj	ƒ‚|j
jj}| j j|ƒ}g }xDt|ƒD ]8}| j j||ƒ}| j|| jjkƒ | j|ƒ}|j|ƒ qbW |S )NzNOnly basic signed structures are currently supported. NID for this data was {})r`   ZOBJ_obj2nidr¢   ru   rX  ZNID_pkcs7_signedr   ro   r   ZUNSUPPORTED_SERIALIZATIONrØ   Úsignr?  rÏ  rÄ  rÑ  r^   rv   rE  rl   )	rm   rÞ  r¤  rÔ  rÃ   ÚcertsrÅ  r   r?  rW   rW   rX   rÝ  H	  s     

z Backend._load_pkcs7_certificates)N)N)N)érT   rU   rV   Ú__doc__r‘   rÀ  r5   r¡   r"   r  r  r  r  Z
SHA512_224Z
SHA512_256ZSHA3_224ZSHA3_256ZSHA3_384ZSHA3_512ZSHAKE128ZSHAKE256r™   r'   Z	SECP224R1Z	SECP256R1Z	SECP384R1Z	SECP521R1ry  Z_fips_rsa_min_key_sizeZ_fips_rsa_min_public_exponentZ_fips_dsa_min_modulusZ_fips_dh_min_key_sizeZ_fips_dh_min_modulusrn   Ústrrr   rw   ÚtypingÚOptionalÚListr»   ZOpenSSLErrorru   ra   ry   r   Ú
contextlibr   r€   ri   rˆ   rp   r¾   rŠ   ÚbytesZHashAlgorithmr   r�   r–   r—   rš   rœ   r�   rž   ZHashContextrŸ   r4   rI   r¦   rª   rd   r   r°   r±   r²   rº   r¼   rÂ   rÇ   r*   ZRSAPrivateKeyrÒ   rÔ   ZRSAPrivateNumbersrß   ZRSAPublicNumbersZRSAPublicKeyrà   râ   rÏ   rQ   ræ   rç   ré   r1   r  r2   r
  r  r$   r  r  r&   ZDSAParametersr  ZDSAPrivateKeyr  r  r#  ZDSAPrivateNumbersr'  ZDSAPublicNumbersZDSAPublicKeyr)  ZDSAParameterNumbersr*  r  r+  r,  r/  r3   r	   r0  r2  r:  r%   ZDHParametersr;  r÷   r<  r	  r>  r   ZCertificateÚAnyrC  rE  rI  r1  ÚNoReturnr7  ZEllipticCurver[  ZEllipticCurveSignatureAlgorithmr]  ZEllipticCurvePrivateKeyrb  ZEllipticCurvePrivateNumbersro  ZEllipticCurvePublicNumbersZEllipticCurvePublicKeyrp  rt  rw  r_  rx  rz  r{  r`  rW  rf  rg  r#   r@  r€  r�  rŒ  rˆ  r‰  r�  r�  r‘  r•  r–  ZDHPrivateKeyr—  r˜  ZDHPrivateNumbersr�  ZDHPublicNumbersZDHPublicKeyrž  ZDHParameterNumbersrŸ  r   r¡  r,   ZX25519PublicKeyr¢  ZX25519PrivateKeyr£  r¥  r¦  r§  r+   ZX448PublicKeyr«  ZX448PrivateKeyr­  r®  r¯  r°  r)   ZEd25519PublicKeyr´  ZEd25519PrivateKeyrµ  r¶  r·  r(   ZEd448PublicKeyr¹  ZEd448PrivateKeyrº  r»  r¿  rÃ  rÆ  rÈ  ÚTuplerÌ  rN   rË  rO   rP   rØ  rÙ  r   rÚ  rÛ  rß  rà  rÝ  rW   rW   rW   rX   rY      sÆ  
		E	&F;*2.3(
t0/

 

K
 rY   c               @   s,   e Zd Zedœdd„Zeeedœdd„ZdS )r«   )Úfmtc             C   s
   || _ d S )N)Ú_fmt)rm   rí  rW   rW   rX   rn   _	  s    zGetCipherByName.__init__)ri  r    rx   c             C   sd   | j j||d�jƒ }|jj|jdƒƒ}||jjkrX|jjrX|jj	|jj|jdƒ|jjƒ}|j
ƒ  |S )N)r    rx   r‚   )rî  ro   Úlowerr`   r�  r“   r^   rv   ZCryptography_HAS_300_EVP_CIPHERZEVP_CIPHER_fetchr¼   )rm   ri  r    rx   rÂ  r¥   rW   rW   rX   Ú__call__b	  s    
zGetCipherByName.__call__N)	rT   rU   rV   rä  rn   rY   r4   rI   rð  rW   rW   rW   rX   r«   ^	  s   r«   )ri  r    c             C   s$   d|j d › d�}| jj|jdƒƒS )Nzaes-rJ  z-xtsr‚   )rÉ   r`   r�  r“   )ri  r    rx   rÂ  rW   rW   rX   r¬   w	  s    r¬   )xÚcollectionsrè  r®   rå  rf   r   Zcryptographyr   r   Zcryptography.exceptionsr   r   Z$cryptography.hazmat.backends.opensslr   Z,cryptography.hazmat.backends.openssl.ciphersr   Z)cryptography.hazmat.backends.openssl.cmacr	   Z'cryptography.hazmat.backends.openssl.dhr
   r   r   r   Z(cryptography.hazmat.backends.openssl.dsar   r   r   Z'cryptography.hazmat.backends.openssl.ecr   r   Z*cryptography.hazmat.backends.openssl.ed448r   r   r   Z,cryptography.hazmat.backends.openssl.ed25519r   r   Z+cryptography.hazmat.backends.openssl.hashesr   Z)cryptography.hazmat.backends.openssl.hmacr   Z-cryptography.hazmat.backends.openssl.poly1305r   r   Z(cryptography.hazmat.backends.openssl.rsar   r   Z)cryptography.hazmat.backends.openssl.x448r   r   Z"cryptography.hazmat.bindings._rustr    r»   Z$cryptography.hazmat.bindings.opensslr!   Zcryptography.hazmat.primitivesr"   r#   Z*cryptography.hazmat.primitives._asymmetricr$   Z)cryptography.hazmat.primitives.asymmetricr%   r&   r'   r(   r)   r*   r+   r,   Z1cryptography.hazmat.primitives.asymmetric.paddingr-   r.   r/   r0   Z/cryptography.hazmat.primitives.asymmetric.typesr1   r2   Z&cryptography.hazmat.primitives.ciphersr3   r4   Z1cryptography.hazmat.primitives.ciphers.algorithmsr5   r6   r7   r8   r9   r:   r;   r<   r=   r>   r?   r@   Z,cryptography.hazmat.primitives.ciphers.modesrA   rB   rC   rD   rE   rF   rG   rH   rI   Z"cryptography.hazmat.primitives.kdfrJ   Z,cryptography.hazmat.primitives.serializationrK   Z3cryptography.hazmat.primitives.serialization.pkcs12rL   rM   rN   rO   rP   Ú
namedtuplerQ   rS   rY   r«   r¬   ri  rW   rW   rW   rX   Ú<module>   sp   (
8,                 p